hxxps://rfidirect[.]com/?hxxps://rcbe[.]justica[.]gov[.]pt/cBGApxfZt

Analysis

user interaction
yes
max time kernel
14s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://rfidirect.com/?https://rcbe.justica.gov.pt/cBGApxfZt
Sample260824-l2y89seq81

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
332	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320393529488152"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{8B15AB72-3479-4E43-833C-BE90DE6F790A}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 4712	1836	msedge.exe	86
PID 1836 wrote to memory of 332	1836	msedge.exe	87
PID 1836 wrote to memory of 3692	1836	msedge.exe	89
PID 1836 wrote to memory of 3692	1836	msedge.exe	89
PID 1836 wrote to memory of 1528	1836	msedge.exe	88
PID 1836 wrote to memory of 1528	1836	msedge.exe	88
PID 1836 wrote to memory of 1528	1836	msedge.exe	88
PID 1836 wrote to memory of 944	1836	msedge.exe	90
PID 1836 wrote to memory of 944	1836	msedge.exe	90
PID 1836 wrote to memory of 944	1836	msedge.exe	90
PID 1836 wrote to memory of 2988	1836	msedge.exe	91
PID 1836 wrote to memory of 2988	1836	msedge.exe	91
PID 1836 wrote to memory of 2988	1836	msedge.exe	91
PID 1836 wrote to memory of 4120	1836	msedge.exe	93
PID 1836 wrote to memory of 4120	1836	msedge.exe	93
PID 1836 wrote to memory of 4120	1836	msedge.exe	93
PID 1836 wrote to memory of 3284	1836	msedge.exe	94
PID 1836 wrote to memory of 3284	1836	msedge.exe	94
PID 1836 wrote to memory of 3284	1836	msedge.exe	94
PID 1836 wrote to memory of 2424	1836	msedge.exe	97
PID 1836 wrote to memory of 2424	1836	msedge.exe	97
PID 1836 wrote to memory of 2424	1836	msedge.exe	97
PID 1836 wrote to memory of 3460	1836	msedge.exe	99
PID 1836 wrote to memory of 3460	1836	msedge.exe	99
PID 1836 wrote to memory of 3416	1836	msedge.exe	98
PID 1836 wrote to memory of 3416	1836	msedge.exe	98
PID 1836 wrote to memory of 4836	1836	msedge.exe	101
PID 1836 wrote to memory of 944	1836	msedge.exe	102
PID 1836 wrote to memory of 944	1836	msedge.exe	102
PID 1836 wrote to memory of 944	1836	msedge.exe	102

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://rfidirect.com/?https://rcbe.justica.gov.pt/cBGApxfZt
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffdf873c188,0x7ffdf873c194,0x7ffdf873c1a0
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,4257089248784056946,17008161330677822089,524288 --field-trial-handle=2604,i,13358338328002157345,117444253555279858,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:3
  2⤵
  - System Time Discovery
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,15336716233963627081,7950291040173381772,262144 --field-trial-handle=2604,i,13358338328002157345,117444253555279858,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:2
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,11317859402280773329,2670565847484872986,524288 --field-trial-handle=2604,i,13358338328002157345,117444253555279858,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,9910181468977159923,390290897272079586,2097152 --field-trial-handle=2604,i,13358338328002157345,117444253555279858,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,18303787027678643875,13118728528657320154,2097152 --field-trial-handle=2604,i,13358338328002157345,117444253555279858,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,18111411307022947417,14375105236836576882,2097152 --field-trial-handle=2604,i,13358338328002157345,117444253555279858,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,7606802439623992981,10801097375537497893,2097152 --field-trial-handle=2604,i,13358338328002157345,117444253555279858,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3464,i,17076185369896612182,1969742696830225883,2097152 --field-trial-handle=2604,i,13358338328002157345,117444253555279858,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,16683731198028787113,1398070984699786925,524288 --field-trial-handle=2604,i,13358338328002157345,117444253555279858,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3404,i,12846701947299508819,7883276327364817473,524288 --field-trial-handle=2604,i,13358338328002157345,117444253555279858,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,17173583910200257120,14418057141981425344,524288 --field-trial-handle=2604,i,13358338328002157345,117444253555279858,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,17173583910200257120,14418057141981425344,524288 --field-trial-handle=2604,i,13358338328002157345,117444253555279858,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6192,i,11725809949715049632,3970886182027878414,2097152 --field-trial-handle=2604,i,13358338328002157345,117444253555279858,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2bc7f3a4024d9673a2f7a098d546fe1f592a8aa0477eb259121fe80954c2f99d
MD5 403039b77d88ae3c8e79a108e60c95e6
SHA1 478b6a90cbd5967be9b36c911b5a2135e0b7199c
SHA512 fbec8c6863e6042041cea05b5efa69ca53b0340f3bee0900ef55602e442dca5b20c736b16589ad755fc44c45bb2c920ed0e29957fb7ab74fe05e101f104c82fb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7I:fwUQC5VwBIiElEd2K57P7I
TLSH
T1EEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000bd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bd
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 eec203c51d6e2c47943e6660446c9445d8c53589755b5b7d34f1e38a4d499ef8
MD5 706efab1f445e05097101028b35d6c3b
SHA1 b25df7b0f45b709f98352543a9ad653e2bbd5135
SHA512 79d43429c7307dcaf3aa6b46ced5c76517ed64d2dea1c3db7ed57a985e6f193b329a22643364f6ab7fc434f42e99d9d695fb3782864d932fa979a3fafb7561f3
SSDEEP 48:OLrR+c6bDk95gGd8W8d32s+BbGOMfPOBN1K313RRi2I38X/Kd9Z:OLy4LgG62RBrYPOxaV22Li
TLSH
T1FD816F14034A055DFB234733E6FB0E65B9FC41C52B6F6E4630592ABD397A3A3180883C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe586b96.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586b96.TMP
Size 3KB
SHA256 048fcfdb5d56c6b83bf0feada49fcb99df3cfd4cbc99c081acca446aa7c9e7d5
MD5 7c04e6d106c1f521f3fecd354be3aaa1
SHA1 5f5b6d114847cd8d13efcf26921bfe14db91fc8b
SHA512 7fda7c59b09eeb81e7d8db292fd5321ac068b2742c9047a5ec56dade7dede27d3b8e231d83e73ffa30f8f13b03caf623324c252de77516fea29ef6922df5ec9e
TLSH
T15B61F82503120A5CF3719372E6F35E65F9FC81D51B6F8E467096297E763AB63481143C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 c721abaf484c99945e0baa676c351433bf4510ab0420dbba375c8019e96856e7
MD5 a12af4b871f98a58c9f54828d227cc44
SHA1 abdba9a73e405ac26d1b8ccd2cd2e7c4529d7faa
SHA512 87815aad747225341ee2650db8c6fe368e27837c72b5e9c0e58ea9d4644193c3951010acfe4a597c36a1c0e5242e7cf7b4b63fb0ace4ea81dbf0f625aae4fe55
SSDEEP 192:DXu8pQQ2h618mA38m6BN8z8Vee+ELctDZyrZO2XFvu1Re:DXu8pQQ2h618mA38m6BN8z8Vee+ELctA
TLSH
T174D17AB783E5D56E890259F4DB14AE2ACF1D0629422C3C66CCD8BF47E3E3462E10161B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2922e1377f2df9ba19fc41e393d17bae9a167ab600ae7c4ba57d61f5907a7c1d
MD5 716a589f49e3794d4d08b47c4aab9639
SHA1 ecdbc13c91d59fab7b89edad1e63a01ccf2f73ad
SHA512 47029910efe244d37516b7c0da5b1627607e7052535c43e23794106459f46278c7e14cff89746b88d63d916f7b36803e98a0326d871d95841c6f0c141de19700
SSDEEP 192:sxZPRbayM/jK1Ml8MkU/fXsXgH6LIdpeklHW6+WNbToY/YHpiNcIgrJ:sxZPYMU/fXsXgH6UecHbbT/S9
TLSH
T1B952E811AA386977CCDBD20DF955BF93D6F90472A2901E44A9FCCA1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b4c34b8a7622f5c5e3a3aed86657428ce89efd7aed38abadc9699a8a80056752
MD5 8585ef4460b911eaab03e537c37d4bff
SHA1 240899459922eb45da577fa5ab1b16b82bee3b94
SHA512 b5ce1b185927fbf08fbc7e7b84ff7e899b85c6cf3c05e162f721186c90774aae4702b79db784fef53c1f42fcc535622c5ae613abcdc1e95047f26317f57cfde6
SSDEEP 192:sxZPRbayM/jK1Ml8bkU/fXsDgBWpVY6CIdpeklHW6+WNbdu7ToY/YnNhV+IgFJ:sxZPYdU/fXsDgBWvY6recHbbdmT/fv
TLSH
T1C852D811AA346D7BCCDBD20DF9567F53D6F91432A2901E44A9FC9A2C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f932d0d082f2a7f473692d9d4c2309335369178e775ae9719cfa045b6177efe0
MD5 97fc2f5663566cdd3dad12bede07cd9d
SHA1 9df94b1082bc1608a0193538229de996bbf32106
SHA512 9ceb52bfbcc8afba7f13f505983ec27b7678f0d8ee9c06580c5b80de56693c5eabcbf8cbed228d538d3d1934d57c2bd2a31359a9e7bd8da7fb8dc2d0d365ef32
SSDEEP 768:1YUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RqroVc0P:1YUZYTMWvg0Pou1ja7eLZmRBNP
TLSH
T121D20B2B280CCB7E4F844E9DEC266F967ED801CB5A584D5447EA884C02CB6EB512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 e513bc6d0cc1522365123a3d2842b698c27855aca301a197be972e56d843ee50
MD5 b5f01713446e70a4941dcf9017e266a1
SHA1 3f9d496c0621d36dee2b1fad6d87dcb362905813
SHA512 435e958c3668d039498b62a60776f9a49318b5b35c20c403a0536f673c710f6312a4aad94e12f78ea291fbcdf636970bea100f7322b95ed3a868995a607d429e
TLSH
T1F0A00227A1858254C90A967315A5C25526146D6910140212B4F14A8BCD641607545402
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 d07e95f00784c39dec449210f5d127e80ea0982d7586003cfc79e2c6b5b70d1e
MD5 3e7420922af5a9ab51b56bf172a64703
SHA1 3997b711038dc60cfe39c3fa984a48bf1e98c653
SHA512 27f6a5ef4437587d35ea3ba1b72585eb78de8b16b0e6ac3c97e006cb368017a6647e9a866e8daebfe3bdc09aa07855dd590a45689035578e0587d294eb817717
SSDEEP 96:KA1eK2AkWcKjCGm7mKM47iQKDKq25mKy4i:EGbdzHFT
TLSH
T1FDD1095270B7D2123C3D2B0892D59767DE81F1A37018A4AB7B6D11B58E2BD209DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 52a9ecaf894bd87e59d7502b979e29cac32ba3bc9790511e33cf43d7f1e9a278
MD5 cc43557a2d86487badbbae466528d12d
SHA1 fb5c7055cfb242c1fca25d4e9a11fab3b11f9043
SHA512 4f4ac129a0f0cf4f7c06278f55179c065dee624c8f7b373d27ad31eff57d9708d3678d2bdaff997fb6b686e7233f7ea175890d5d2ec2798c6ab0d0f12a02be97
SSDEEP 192:uXLsN+lQj2KuAJrttSFQmiU1G1G4zX5Obd+jA+Fdg3ao+d1ySJrh4QPqwU8:UsN+l2nhkUJzX5od+ndiV+DtJrznU8
TLSH
T1693209326838AC778DE3E545F48736539FE45167DA893FC4D2FC6B1C00DA6AC131A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 3e835ffbd7ae99954cb6e07ad0cc107c6ac946ad18264cf57ac34e919b0ac49b
MD5 d00e0417b0352631f2fc99910951dc61
SHA1 6ab827684a2fd77b6ffb9b479d0c37bee0b4d7f5
SHA512 0ba89a8f6f8fa8bab3548d0f9de8dcc4991beea7b997054277f7022991af52cb6801e4af8d57de556ee70c4789769ddd138ef669cea358efc22d6fd42a973599
SSDEEP 384:6sN+l2nhk5JzX5od+ndiV+DtJrzHPAStvn1sDkK4i41anU8:6Wn2xOOYChzYS8AK4i41anU8
TLSH
T1618208B1D4A56CF748A2E4C9A583F5136EA41033CA8D6E4CD2FDB63C309F5F8235A422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6fdfccaad611d87d7c18136200397331764d169c9b2b187a25db7edd02dcb6e3
MD5 931564aadd9c720957a8ed1f9aaf3d04
SHA1 ba9aa1b6bdb76769d85d2a67eb068812168f3a21
SHA512 d944bd529788a576b9742e01ca566764f5fc535ca8a7d574e890db8fce359fe9737a761e3bb07d9755da3451b707b7b2921df61c260ab10d7618f82d669e85ae
SSDEEP 192:yONR61VWQmiUycIgGX5Obd+jA+Fdg3ao+j/at3jsU6:yONR6WmgGX5od+ndiV+mFsU6
TLSH
T14A02D73568687C6BCEF2BE4AB48737235F952067EA942F84D6FC1B1C009769C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 94acbd608879fbdf9ab32cb2eea8392e15ed9aecd3ea8b5258165969fb3bcd50
MD5 297eca32af80b6815147a2fd6ab4d9a1
SHA1 b5573dbc895d5704aa4bfe152d217e10e1454db8
SHA512 4c83edbcedffd41e2af361dcab389cf67a24cd6f1413aeccc969f804becb7336c19efaa6c2f9983ebbb49a3a7a1bd7a46aa383746d2fc0e10e6ff222239ede2c
SSDEEP 192:dON/61+WQmiUy0IrGX5Obd+jA+Fdg3ao+d1ySJrrjJPqwU6:dON/6XArGX5od+ndiV+DtJr5nU6
TLSH
T1BE121A326468AC7B8EE3B446F48735539FD55167EA897FC091FC2B1C00EB6AC134A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cd8d45a70c1fcee739be352ba753f66aa6d5baba210d7404fdd0eea20c0e3a17
MD5 d0a9481c1f531338b2999aefa2e743a8
SHA1 4f75b87c3501473b5bd8081a95303c0637cb58f5
SHA512 044beb88ca3b30e6f88f4e605b90652d59d0cf7bdcca127d24a2b3dca6d38a496124c13ea99a717360686a6b76d5e855d5b21761240b5a0967627f1f820eacc5
TLSH
T187415A5CAAEE0108B3776F5A9BF6686D487FB9332E0AD55D10110E4F0A22F40D8B1B33
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads